Support account-ID based endpoints for IMDS and container credentials by S-Saranya1 · Pull Request #7513 · aws/aws-sdk-java-v2

S-Saranya1 · 2026-11-04T20:33:36Z

Motivation and Context

EC2 introduced an opt-in header (X-amzn-extended: 1) on the existing IMDS credentials path that returns the Account ID in the response. This enables account ID based endpoint resolution for services that support it.

The container credentials provider shares the same response parser, so it will also pick up AccountId when the container credentials endpoint returns it. ECS and EKS don't return it today, so there's no change for container users yet.

Modifications

InstanceProfileCredentialsProvider: Send X-amzn-extended: 1 header on the credential GET request (not on token PUT or profile discovery GET). Returns immutable header map.
HttpCredentialsLoader(shared by IMDS and container providers): Parse AccountId from the credentials response and attach it to the resolved credentials. Gracefully handles absence (null when not present).

No changes to endpoint resolution, the existing accountIdEndpointMode pipeline already handles Account ID when available on credentials.

Testing

Added these tests -

HttpCredentialsLoaderTest: AccountId parsed when present, absent gracefully handled, unexpected JSON fields ignored
InstanceProfileCredentialsProviderTest: Extended header sent on credential GET only (NOT on token PUT or profile discovery), AccountId present and absent cases
ContainerCredentialsProviderTest: AccountId present and absent cases
ImdsAccountIdEndpointTest: End-to-end DynamoDB endpoint resolution - IMDS credentials with AccountId resolves to account-based endpoint, without AccountId falls back to standard endpoint
Integration testing: Performed integration tests on actual EC2 instances: verified AccountId is returned from IMDS and populated on the resolved credentials, and that credentials still resolve without AccountId when it is not returned.

Screenshots (if appropriate)

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)

Checklist

I have read the CONTRIBUTING document
Local run of mvn install succeeds
My code follows the code style of this project
My change requires a change to the Javadoc documentation
I have updated the Javadoc documentation accordingly
I have added tests to cover my changes
All new and existing tests passed
I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

I confirm that this pull request can be released under the Apache 2 license

kdaily · 2026-11-04T22:05:32Z

+    "type": "feature",
+    "category": "AWS SDK for Java v2",
+    "contributor": "",
+    "description": "Add support for account-ID based endpoints when using IMDS credential provider. The SDK now sends the `X-amzn-extended: 1` header on IMDS credential requests and parses the `AccountId` field from the response when available."


Should this describe more specifically what will change for users of container credentials (ECS/EKS)? Wouldn't the endpoint change for them as well? If they are allowlisting traffic, adding the account ID to the hostname may break that; the effect on container credential providers isn't called out here.

Good point! ECS and EKS don't return AccountId today, so there's no change for container users right now. If they start returning it, the SDK will pick it up, so good to update the changelog to mention about it, and added tests for container credentials as well for this.

kdaily · 2026-11-04T22:12:38Z

+
+    /**
+     * Test that loadCredentials does not fail when response contains unexpected/unknown fields.
+     * This verifies the SEP requirement: "Parsing MUST NOT fail in the presence of unexpected fields."


nit: reference to SEP.

kdaily · 2026-11-04T22:15:00Z

+    "type": "feature",
+    "category": "AWS SDK for Java v2",
+    "contributor": "",
+    "description": "Add support for account-ID based endpoints when using IMDS credential provider. The SDK now sends the `X-amzn-extended: 1` header on IMDS credential requests and parses the `AccountId` field from the response when available."


Might also be worth reiterating how to opt out (if we did that before when adding support).

ianbotsf · 2026-11-05T20:45:02Z

                                              .endpoint(URI.create(imdsHostname + SECURITY_CREDENTIALS_RESOURCE
                                                                   + securityCredentials[0]))
-                                              .headers(getTokenHeaders(token))
+                                              .headers(getCredentialHeaders(token))


Not introduced by this PR, but related. createEndpointProvider() calls getSecurityCredentials() on every refresh, so the profile name is looked up each time. The spec expects the name to be stored after the first lookup. The shared test suite expects one profile GET followed by two credential GETs, so it would fail here. Happy for this to be a follow-up issue rather than block this PR.

ianbotsf · 2026-11-05T20:45:02Z

+
+    private MockSyncHttpClient mockHttpClient;
+
+    @BeforeEach


nit: the IMDS endpoint system property is set in @BeforeEach but only cleared in @AfterAll. Could we pair them (@BeforeEach/@AfterEach, or set it once in @BeforeAll)? Also, should this test pin accountIdEndpointMode, or clear AWS_ACCOUNT_ID_ENDPOINT_MODE, so a value from the environment can't change the endpoint assertions?

ianbotsf · 2026-11-05T20:45:02Z

+import com.github.tomakehurst.wiremock.junit5.WireMockExtension;
+import java.time.Duration;
+import java.time.Instant;
+import software.amazon.awssdk.http.AbortableInputStream;


nit: import order. The software.amazon.awssdk.http.* imports come before the org.junit.* ones. Checkstyle's CustomImportOrder flags this.

ianbotsf · 2026-11-05T20:47:10Z

One gap before approval: the spec ships a standardized JSON test suite (imds-v22-tests.json) that implementations are required to run. The hand-written tests here cover similar cases, but could we add a data-driven test that runs the shared suite as-is? That keeps us in sync if the suite changes later.

S-Saranya1 added 3 commits November 4, 2026 12:17

Add IMDS extended credentials header for Account ID support

ad376a7

Add integration tests for IMDS account-ID endpoint resolution

376215d

Address PR feedback

29aa1f3

S-Saranya1 requested a review from a team as a code owner November 4, 2026 20:33

S-Saranya1 added the no-api-surface-area-change Indicate there is no API surface area change and thus API surface area review is not required label Nov 4, 2026

kdaily reviewed Nov 4, 2026

View reviewed changes

S-Saranya1 added 2 commits November 5, 2026 11:10

Adress review comments

ebcd11e

Update changelog and add tests for container credentials as well

c9e7678

S-Saranya1 requested a review from kdaily November 5, 2026 19:40

S-Saranya1 changed the title ~~Support account-ID based endpoints for IMDS credential provider~~ Support account-ID based endpoints for IMDS and container credentials Nov 5, 2026

ianbotsf reviewed Nov 5, 2026

View reviewed changes

Navigation Menu

Repository navigation

Support account-ID based endpoints for IMDS and container credentials - #7513

Support account-ID based endpoints for IMDS and container credentials#7513
S-Saranya1 wants to merge 5 commits into
masterfrom
somepal/imds-account-id

S-Saranya1 commented Nov 4, 2026 •

edited

Loading

Uh oh!

kdaily Nov 4, 2026 •

edited

Loading

Uh oh!

S-Saranya1 Nov 5, 2026

Uh oh!

kdaily Nov 4, 2026

Uh oh!

S-Saranya1 Nov 5, 2026

Uh oh!

kdaily Nov 4, 2026

Uh oh!

S-Saranya1 Nov 5, 2026

Uh oh!

ianbotsf Nov 5, 2026

Uh oh!

ianbotsf Nov 5, 2026

Uh oh!

ianbotsf Nov 5, 2026

Uh oh!

ianbotsf commented Nov 5, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

S-Saranya1 commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

Modifications

Testing

Screenshots (if appropriate)

Types of changes

Checklist

License

Uh oh!

kdaily Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ianbotsf commented Nov 5, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

S-Saranya1 commented Nov 4, 2026 •

edited

Loading

kdaily Nov 4, 2026 •

edited

Loading